Archive
1 March 2022
Vulnerabilities first published on this day (UTC), newest first.
6 results · Clear filters · Feed
-
Critical 9.8
Use of Externally-Controlled Format String in wire-avs
wire-avs is the audio visual signaling (AVS) component of Wire, an open-source messenger. A remote format string vulnerability in versions prior to 7.1.12 allows an attacker to cause a denial of service or possibly execute arbitrary code. The issue has been f…
-
Critical 9.8
An improper authentication vulnerability in FortiMail before 7.0.1 may allow a remote attacker to efficiently guess one…
-
Critical 9.8
A command injection vulnerability in the web interface of the Zyxel NWA-1100-NH firmware could allow an attacker to exe…
-
Critical 9.8
Hicos citizen certificate client-side component - Command Injection
Hicos citizen certificate client-side component does not filter special characters for command parameters in specific web URLs. An unauthenticated remote attacker can exploit this vulnerability to perform command injection attack to execute arbitrary system c…
-
Critical 9.1
Neo4j Graph Database vulnerable to Path Traversal
A directory traversal vulnerability in the apoc plugins in Neo4J Graph database before 4.4.0.1 allows attackers to read local files, and sometimes create local files. This is fixed in 3.5.17, 4.2.10, 4.3.0.4, and 4.4.0.1.
-
Critical 9.8
Improper Input Validation in image_processing
image_processing is an image processing wrapper for libvips and ImageMagick/GraphicsMagick. Prior to version 1.12.2, using the `#apply` method from image_processing to apply a series of operations that are coming from unsanitized user input allows the attacke…